Unam4

**Name of the Vulnerable Software and Affected Versions** Apache Tomcat versions 11.0.0-M1 through 11.0.24 Apache Tomcat versions 10.1.0-M1 through 10.1.57 Apache Tomcat versions 9.0.0.M1 through 9.0.120 Apache Tomcat versions 8.5.0 through 8.5.100 **Description** An off-by-one error in the rewrite valves occurs when the `[N]` flag is used. This causes the rewrite processing to restart at the second rule instead of the first rule. **Recommendations** Upgrade Apache Tomcat versions 11.0.0-M1 through 11.0.24 to version 11.0.25. Upgrade Apache Tomcat versions 10.1.0-M1 through 10.1.57 to version 10.1.58. Upgrade Apache Tomcat versions 9.0.0.M1 through 9.0.120 to version 9.0.121.

**Name of the Vulnerable Software and Affected Versions** Apache Tomcat versions 11.0.0-M1 through 11.0.24 Apache Tomcat versions 10.1.0-M1 through 10.1.57 Apache Tomcat versions 9.0.0.M1 through 9.0.120 Apache Tomcat versions 8.5.0 through 8.5.100 Apache Tomcat versions 7.0.0 through 7.0.109 **Description** An incorrect authorization issue exists in the FORM authentication process. This allows the bypassing of a security constraint that restricts a user to POST access while denying GET access to a resource. **Recommendations** Upgrade to version 11.0.25. Upgrade to version 10.1.58. Upgrade to version 9.0.121.

**Name of the Vulnerable Software and Affected Versions** Apache Tomcat versions 11.0.0-M1 through 11.0.24 Apache Tomcat versions 10.1.0-M1 through 10.1.57 Apache Tomcat versions 9.0.25 through 9.0.120 Apache Tomcat versions 8.5.46 through 8.5.100 Apache Tomcat versions 7.0.97 through 7.0.109 **Description** An improper authorization issue exists where `security-role-ref` definitions are incorrectly used as role aliases within the Realm, in addition to their intended use with `Request.isUserInRole()`. **Recommendations** Upgrade versions 11.0.0-M1 through 11.0.24 to 11.0.25. Upgrade versions 10.1.0-M1 through 10.1.57 to 10.1.58. Upgrade versions 9.0.25 through 9.0.120 to 9.0.121.

**Name of the Vulnerable Software and Affected Versions** Apache Tomcat versions 11.0.0-M1 through 11.0.24 Apache Tomcat versions 10.1.0-M1 through 10.1.57 Apache Tomcat versions 9.0.0.M1 through 9.0.120 Apache Tomcat versions 8.5.0 through 8.5.100 Apache Tomcat versions 7.0.30 through 7.0.109 **Description** An authentication bypass exists in the DIGEST authenticator. If a client makes a DIGEST authenticated request with a `nonceCount` on the upper boundary of the replay window before `windowSize` requests are made, that request can be replayed once while the associated `nonceCount` remains within the replay window. **Recommendations** Upgrade versions 11.0.0-M1 through 11.0.24 to 11.0.25. Upgrade versions 10.1.0-M1 through 10.1.57 to 10.1.58. Upgrade versions 9.0.0.M1 through 9.0.120 to 9.0.121. At the moment, there is no information about a newer version that contains a fix for this vulnerability for versions 8.5.0 through 8.5.100 and 7.0.30 through 7.0.109.

**Name of the Vulnerable Software and Affected Versions** Apache Tomcat versions 11.0.0-M1 through 11.0.24 Apache Tomcat versions 10.1.0-M1 through 10.1.57 Apache Tomcat versions 9.0.0.M1 through 9.0.120 Apache Tomcat versions 8.5.0 through 8.5.100 Apache Tomcat versions 7.0.0 through 7.0.109 **Description** Improper access control and incorrect authorization allow an unauthenticated attacker to bypass security constraints. This occurs when a security constraint for a longer path is processed before a more restrictive constraint for a shorter sub-path, leading the system to evaluate constraints incorrectly and grant access to protected resources. **Recommendations** Upgrade Apache Tomcat versions 11.0.0-M1 through 11.0.24 to version 11.0.25. Upgrade Apache Tomcat versions 10.1.0-M1 through 10.1.57 to version 10.1.58. Upgrade Apache Tomcat versions 9.0.0.M1 through 9.0.120 to version 9.0.121. At the moment, there is no information about a newer version that contains a fix for Apache Tomcat versions 8.5.0 through 8.5.100. At the moment, there is no information about a newer version that contains a fix for Apache Tomcat versions 7.0.0 through 7.0.109.

**Name of the Vulnerable Software and Affected Versions** mchange-commons-java versions prior to 0.6.0 **Description** The JNDI ObjectFactory implementation `com.mchange.v2.naming.JavaBeanObjectFactory` allows the construction of objects from arbitrary classes and the initialization of JavaBean-style properties. This behavior enables JNDI injection and the use of deserialization gadgets, which are sequences of executable code that can be triggered during the deserialization of an object. For instance, configuring the `contentType` property of a Swing JEditorPane to text/html and the `text` property to HTML containing a stylesheet `<link>` can trigger an HTTP GET request to an arbitrary URL. This risk is increased by the `ReferenceIndirector`, which allows malicious JNDI Reference objects to be smuggled and dereferenced when an application reads a Java-serialized object. **Recommendations** Update to version 0.6.0.

**Name of the Vulnerable Software and Affected Versions** MySQL Server versions 8.4.0 through 8.4.9 MySQL Server versions 9.0.0 through 9.7.0 MySQL Cluster versions 8.0.11 through 8.0.46 MySQL Cluster versions 8.4.0 through 8.4.9 MySQL Cluster versions 9.0.0 through 9.7.0 **Description** An issue exists in the Server: Connection Handling component. An unauthenticated attacker with network access via multiple protocols can exploit this to cause a hang or a frequently repeatable crash, resulting in a complete Denial of Service (DOS), which is a condition where the service becomes unavailable to legitimate users. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Apache HertzBeat versions prior to 1.7.0 **Description** An XML injection Remote Code Execution (RCE) vulnerability exists in Apache HertzBeat due to parsing of HTTP sitemap XML responses. An attacker with an authenticated account and access can trigger the vulnerability by adding a monitor that parses XML and returns specially crafted content. **Recommendations** Upgrade to version 1.7.0.

Name of the Vulnerable Software and Affected Versions: DataEase versions prior to 2.10.11 Description: DataEase is an open source business intelligence and data visualization tool. The issue lies in parameters like `sslfactory` and `sslfactoryarg`, which have similar functionality to `socketfactory` and `socketfactoryarg`, but need to be triggered after establishing the connection. Other similar parameters include `sslhostnameverifier`, `sslpasswordcallback`, and `authenticationPluginClassName`. Recommendations: For versions prior to 2.10.11, update to version 2.10.11 to resolve the issue. As a temporary workaround, consider restricting the use of parameters like `sslfactory` and `sslfactoryarg` until the update is applied.

Name of the Vulnerable Software and Affected Versions: Apache HertzBeat (incubating) versions prior to 1.6.1 Description: This issue is related to an improper neutralization of special elements used in a command, also known as a 'Command Injection' vulnerability. The vulnerability can only be exploited by authorized attackers. Recommendations: For Apache HertzBeat (incubating) versions prior to 1.6.1, upgrade to version 1.6.1 to resolve the issue. As a temporary workaround, consider restricting access to sensitive commands or functions to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** DataEase versions prior to 2.10.2 **Description** The issue allows attackers to forge JWT and take over services due to the JWT secret being hardcoded in the code. Additionally, the UID and OID are also hardcoded. This has been fixed in version 2.10.2. **Recommendations** For versions prior to 2.10.2, update to version 2.10.2 to resolve the issue. As a temporary workaround, consider restricting access to services that use the hardcoded JWT secret until the update is applied.

Name of the Vulnerable Software and Affected Versions: Nginx UI versions 2.0.0-beta.35 and earlier Description: The issue is related to the Nginx UI's handling of JSON fields without proper verification, allowing an attacker to construct a value in the form of `../../` and write arbitrary files to the server. This may result in loss of permissions. The vulnerability can be exploited by a remote attacker and may lead to unauthorized file writes. Recommendations: For Nginx UI versions 2.0.0-beta.35 and earlier, update to version 2.0.0-beta.26 or later to fix the issue. As a temporary workaround, consider restricting access to the JSON handler to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: Nginx UI versions prior to 2.0.0-beta.36 Description: The issue is related to the configuration settings of the Nginx UI server, specifically the `/api/configs` directory, and is associated with weaknesses in the authorization procedure. This can be combined with directory traversal to read directories and file contents on the server. Recommendations: For versions prior to 2.0.0-beta.36, update to version 2.0.0-beta.36 to fix the issue. As a temporary workaround, consider restricting access to the `/api/configs` API endpoint until a patch is available.

**Name of the Vulnerable Software and Affected Versions** sofahessian versions prior to 3.5.5 **Description** The SOFA Hessian protocol uses a blacklist mechanism to restrict deserialization of potentially dangerous classes for security protection. However, there is a gadget chain that can bypass the SOFA Hessian blacklist protection mechanism, and this gadget chain only relies on JDK and does not rely on any third-party components. **Recommendations** To resolve the issue, upgrade to sofahessian version 3.5.5. For users unable to upgrade, maintain a blacklist in the directory `external/serialize.blacklist` as a temporary workaround.

**Name of the Vulnerable Software and Affected Versions** DataEase versions prior to 1.18.25 **Description** DataEase is an open source data visualization analysis tool. The PostgreSQL data source function allows customization of JDBC connection parameters and the PG server target. However, the PgConfiguration class in backend/src/main/java/io/dataease/provider/datasource/JdbcProvider.java does not filter any parameters and directly concatenates user input. This allows an attacker to add parameters to the JDBC URL and connect to a malicious PG server, triggering the PG JDBC deserialization vulnerability. The attacker can then execute system commands and obtain server privileges through the deserialization vulnerability. **Recommendations** For versions prior to 1.18.25, update to version 1.18.25 or later to fix the vulnerability. As a temporary workaround, consider restricting access to the PostgreSQL data source function to minimize the risk of exploitation. Avoid using customized JDBC connection parameters and PG server targets until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Apache OFBiz versions through 18.12.14 **Description** This issue affects Apache OFBiz, allowing unauthenticated endpoints to execute screen rendering code of screens if certain preconditions are met, such as when screen definitions do not explicitly check user permissions. The vulnerability is related to incorrect authorization and can lead to remote code execution. It is being actively exploited, and proof-of-concept exploits are available. Users are recommended to upgrade to version 18.12.15 to fix the issue. **Recommendations** Apache OFBiz versions through 18.12.14: Upgrade to version 18.12.15 to resolve the issue. As a temporary workaround, consider restricting access to unauthenticated endpoints to minimize the risk of exploitation.